CVE-2026-57128: PraisonAI Authentication Bypass Vulnerability

CVE-2026-57128 Overview

CVE-2026-57128 affects PraisonAI, a multi-agent teams system for orchestrating AI agents. The vulnerability resides in the Server-Sent Events (SSE) server implementation at src/praisonai-agents/praisonaiagents/server/server.py. The server does not consult ServerConfig.auth_token before handling /publish, /events, or /info requests. Any network client that can reach the server can broadcast arbitrary events to connected clients and retrieve server configuration and client-count information. The issue is classified under [CWE-306] Missing Authentication for Critical Function. It is fixed in praisonaiagents version 1.6.58.

Critical Impact
Unauthenticated adjacent-network attackers can publish arbitrary events to SSE subscribers and disclose server configuration, undermining the integrity of agent-to-agent messaging.

Affected Products

PraisonAI praisonaiagents package prior to version 1.6.58
SSE server component in src/praisonai-agents/praisonaiagents/server/server.py
Deployments configuring ServerConfig.auth_token under the assumption of enforcement

Discovery Timeline

2026-09-14 - CVE-2026-57128 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-57128

Vulnerability Analysis

The PraisonAI SSE server exposes three endpoints: /publish for broadcasting events, /events for subscribing to the event stream, and /info for retrieving server metadata. Although ServerConfig supports an auth_token field intended to gate access, the request handlers never validated the bearer token before processing requests. Any client with network reachability to the listening interface could publish crafted events consumed by all connected agents, subscribe to the live event stream, or query configuration and client-count details. Because the flaw is a missing check rather than a bypassable one, exploitation requires no special payload — a standard HTTP request suffices.

Root Cause

The root cause is [CWE-306] Missing Authentication for Critical Function. The server accepted the auth_token configuration value but the routing layer did not invoke an authorization helper before dispatching to handler logic. The fix introduces a _authorise_request method that verifies a bearer token (or the X-Auth-Token header) against self.config.auth_token when configured.

Attack Vector

Exploitation requires adjacent-network access to the SSE server. An attacker sends an HTTP POST to /publish to inject arbitrary events into the broadcast stream, or issues a GET to /info to disclose configuration and client-count data. Downstream agents processing attacker-controlled events may take unintended actions based on forged messages.

python

# Patch: introducing bearer/X-Auth-Token verification in server.py
        self._server_thread: Optional[threading.Thread] = None
        self._app = None
        self._server = None

    def _authorise_request(self, request) -> bool:
        """Verify bearer token when auth_token is configured."""
        token = self.config.auth_token
        if not token:
            return True
        auth = request.headers.get("Authorization", "")
        if auth.startswith("Bearer ") and auth[7:] == token:
            return True
        return request.headers.get("X-Auth-Token") == token

    def _create_app(self):
        """Create the ASGI application."""

Source: GitHub Commit 2f9677a

Detection Methods for CVE-2026-57128

Indicators of Compromise

Unexpected HTTP POST requests to the /publish endpoint from unfamiliar source addresses within the local network segment.
Access log entries for /info or /events lacking an Authorization: Bearer or X-Auth-Token header.
Downstream agents processing events with unusual payloads, senders, or timing that do not correlate with legitimate publisher activity.

Detection Strategies

Enable HTTP request logging on the SSE server and alert on any requests to /publish, /events, or /info missing the configured auth header.
Baseline the set of expected client IPs and flag connections from hosts outside the approved allow-list.
Correlate agent action logs with /publish events to identify forged messages that did not originate from a trusted producer.

Monitoring Recommendations

Ingest PraisonAI server logs into a centralized log platform and build detections on unauthenticated endpoint access.
Monitor for anomalous spikes in /events subscribers, which may indicate reconnaissance of the event stream.
Track version metadata from the /info endpoint response to confirm all deployed instances are running praisonaiagents 1.6.58 or later.

How to Mitigate CVE-2026-57128

Immediate Actions Required

Upgrade praisonaiagents to version 1.6.58 or later, which enforces auth_token on /publish, /events, and /info.
Configure a strong, randomly generated ServerConfig.auth_token and distribute it only to authorized publishers and subscribers.
Restrict network reachability to the SSE server using firewall rules or bind the listener to a trusted interface.

Patch Information

The fix is available in PraisonAI Release v4.6.58 with the corresponding commit at GitHub Commit 2f9677a. Additional details are documented in the GitHub Security Advisory GHSA-35w5-pcw4-jx94.

Workarounds

Place the SSE server behind a reverse proxy that enforces bearer-token authentication for /publish, /events, and /info.
Use network segmentation or a service mesh with mutual TLS (mTLS) to restrict which workloads can reach the SSE endpoints.
Disable the SSE server entirely if inter-agent event broadcasting is not required for the deployment.

bash

# Upgrade to the fixed release and set an auth token
pip install --upgrade 'praisonaiagents>=1.6.58'

# Example client request using the enforced bearer token
curl -H "Authorization: Bearer $PRAISON_AUTH_TOKEN" \
     https://praison.internal:8000/info